Allow chrome:// pages to load extension resources

chrome/browser/extensions/extension_protocols.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/extension_protocols.h"
 
 #include <algorithm>
 
 #include "app/resource_bundle.h"
 #include "base/file_path.h"
@@ skipping 59 matching lines @@
 // Factory registered with URLRequest to create URLRequestJobs for extension://
 // URLs.
 static URLRequestJob* CreateExtensionURLRequestJob(URLRequest* request,
                                                    const std::string& scheme) {
   ChromeURLRequestContext* context =
       static_cast<ChromeURLRequestContext*>(request->context());
 
   const ResourceDispatcherHostRequestInfo* info =
       ResourceDispatcherHost::InfoForRequest(request);
 
-  // Don't allow extension resources to be loaded from origins which are not
-  // present in the extension's effective host permissions with the exception
-  // of empty origins and extension schemes.
-  if (!info->frame_origin().empty() &&
-      !GURL(info->frame_origin()).SchemeIs(chrome::kExtensionScheme)) {
+  // Extension resources should only be loadable from web pages which the
+  // extension has host permissions to (and therefore could be running script
+  // in, which might need access to the extension resources).
+  //
+  // chrome:// pages are exempt. We allow them to load any extension resource.
+  // This is used for, eg, the app launcher in the NTP.
+  //
+  // chrome-extension:// pages are also exempt, mostly for legacy reasons. Some
+  // extensions did this to integrate with each other before we added this code.
+  GURL origin_url(info->frame_origin());
+  if (!origin_url.is_empty() &&
+      !origin_url.SchemeIs(chrome::kChromeUIScheme) &&
+      !origin_url.SchemeIs(chrome::kExtensionScheme)) {
     ExtensionExtent host_permissions =
-      context->GetEffectiveHostPermissionsForExtension(request->url().host());
+        context->GetEffectiveHostPermissionsForExtension(
+            request->url().host());
     if (!host_permissions.ContainsURL(GURL(info->frame_origin())))
       return new URLRequestErrorJob(request, net::ERR_ADDRESS_UNREACHABLE);
   }
 
   // Don't allow toplevel navigations to extension resources in incognito mode.
   // This is because an extension must run in a single process, and an
   // incognito tab prevents that.
   // TODO(mpcomplete): better error code.
   if (context->is_off_the_record() &&
       info && info->resource_type() == ResourceType::MAIN_FRAME)
@@ skipping 55 matching lines @@
 
   return new URLRequestFileJob(request, resource.GetFilePath());
 }
 
 void RegisterExtensionProtocols() {
   URLRequest::RegisterProtocolFactory(chrome::kExtensionScheme,
                                       &CreateExtensionURLRequestJob);
   URLRequest::RegisterProtocolFactory(chrome::kUserScriptScheme,
                                       &CreateUserScriptURLRequestJob);
 }